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WHAT IS CLAIMED IS: 

1 . A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which a confidential value corresponding to 
5 each tag ID information is stored in a confidential value memory of each tag 
device; comprising the steps of 
the tag device 

delivering tag output information which corresponds to a confidential 
value in the confidential value memory from an output section; 

10 and reading out at least part of elements of the confidential value 

from the confidential value memory, applying thereto a first function, an 
inverse image of which is difficult to obtain, and updating the confidential 
value in the confidential value memory with a result of such calculation by 
overwriting in a first calculator. 

15 2. A tag privacy protection method according to Claim 1 in which a 

second calculator of the tag device reads out the confidential value from the 
confidential value memory and applies a second function F2 which disturbs a 
relationship between elements of a definition domain and a mapping thereof 
to the confidential value read out, and a result of such calculation is the tag 

20 output information. 

3. A tag privacy protection method according to Claim 2 in which 
at least one of the first function Fl and the second function F2 is a hash 
function. 

4. A tag privacy protection method according to Claim 2 in which 
25 the first function Fl is a hash function H(x)=hash(p | x) where hash represents 

a hash function for {0, 1 }*— *{0, 1 } r , pe {0, 1 } s and r and s are natural 
numbers and in which the second function F2 is a hash function G(x)=hash(q | 
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x) where qe {0, 1 } s for p^q. 

5. A tag privacy protection method according to Claim 2 in which 
the first function Fl is a hash function H(x)=hash(pad(x, p)) where hash 
represents a hash function for {0, 1 }*— >{0, l} r ,pe{0, 1 } s , pad(x, p) 

5 represents a padding of p to x and r and s are natural numbers and in which 
the second function F2 is a hash function G(x)=hash(pad(x, q)) where pad(x, 
q) represents a padding of q to x and qe {0, 1 } s for p^q. 

6. A tag privacy protection method according to Claim 2 where the 
first function Fl is a hash function H(x) for {0, 1 }*— >{0, 1 } r and r is a natural 

10 number and in which the second function F2 is a hash function G(x)=F(rx) 
where rx represents a bit inversion of x. 

7. A tag privacy protection method according to Claim 2 in which 
at least one of the first function Fl and the second function F2 is a common 
key encryption function. 

15 8. A tag privacy protection method according to Claim 2 in 

which the first function Fl and the second function F2 are an identical 
common key encryption function, to which different common keys are 
applied. 

9. A tag privacy protection method for preventing privacy 
20 information of a user from being acquired from information which is 
delivered from a tag device, in which a first confidential value s k) \ 
corresponding to each tag ID information id k is stored in a confidential value 
memory of each tag device k (ke { 1, . . m}, where m represents a total 
number of tag devices) and in which each tag ID information id n (ne { 1 , . . ., 
25 m} and a corresponding second confidential value s n? i are stored in a database 
memory of a backend apparatus in a manner relating to each other; 
comprising the steps of 
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the tag device 

reading out the first confidential value s kj i from the confidential value 
memory, and applying a second function F2 which disturbs a relationship 
between elements of a definition domain and a mapping thereof to generate 
5 tag output information F2(s k) j) in a second calculator; 

delivering the tag output information F2(s k , i) from an output section; 

and reading out the first confidential value s k> i from the confidential 
value memory, applying thereto a first function Fl, an inverse image of which 
is difficult to obtain, and saving a result of such calculation Fl(s kj i) as new 
10 first confidential value s k) i+ i in the confidential value memory by overwriting 
in a first calculator; 

the backend apparatus 

accepting an input of the tag output information F2(s k> i) at an input 

section ; 

1 5 reading out the second confidential value s n , i from the database 

memory, applying to each second confidential value s n , i read out j times 
(j g {0, . . ., jmax}) the first function Fl and subsequently applying the second 
function F2 thereto in a third calculator ; 

comparing the tag output information F2(s k? i) against the result of 
20 calculation F2(F l j (s n> i)) in a comparator; 

in the event the tag output information F2(s k? j)- does not match the 
result of calculation F2(Fl J (s n? i)), the processings in the third calculator and 
the comparator being executed again by changing the value of at least one of 
n and j; 

25 and extracting by a reader the tag ID information id n which is related 

to the second confidential value s n? i corresponding to the matched result of 
calculation F2(Fl j (s n , i)) from the database memory when the tag output 



information F2(s kj i)- matches the result of calculation F2(Fl J (s nj i)). 

10. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which a first confidential value s kj { and a first 
5 proper value w k corresponding to each tag ID information id k are sored in a 
confidential value memory of each tag device k (ke { 1, . . ., m}, where m 
represents a total number of tag devices) in a manner relating to each other 
and in which each tag ID information id n (ne { 1 , . . ., m}) and a corresponding 
second confidential value s n , i and a second proper value w n are stored in a 
10 database memory of a backend apparatus in a manner relating to each other; 
comprising the steps of 
the tag device 

reading out the first confidential value s ks i from the confidential value 
memory and applying thereto a second function F2 which disturbs a 
15 relationship between elements of a definition domain and a mapping thereof 
to generate tag output information F2(s k? i) in a second calculator; 

delivering the tag output information F2(s k? i) from an output section; 
reading out the first confidential value s k> j and the first proper value 
w k from the confidential value memory, applying a first function F 1 , an 
20 inverse image of which is difficult to obtain, to a bit combination value of the 
first confidential value and the first proper value, and saving a result of such 
calculation Fl(s kj j | w k ) as a new confidential value s kj i+ i in the confidential 
value memory by overwriting in a first calculator; 
the backend apparatus 
25 accepting an input of the tag output information F2(s k? 0 by an input 

section; 

reading out the second confidential value s nj i and the second proper 
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value w n from the database memory, and applying the second function F2 to 
I j (n) where I j (n)=s n , x Q=0) and I J (n>=Fl(I , " 1 (n)) | id n ) (j>l) to calculate 
F2(I j (n)) in a third calculator; 

comparing the tag ID information F2(s ks j) and a result of calculation 
5 F2(I j (n)) in the third calculator in a comparator; 

in the event the tag output information F2(s k} i) does not match the 
result of calculation F2(I J (n)), the processings in the third calculator and the 
comparator being executed again by changing the value of at least one of n 
andj; 

1 0 and in the event the tag output information F2(s k? i) matches the result 

of calculation F2(I J (n)), extracting the tag ID information id n which is related 
to the second confidential value s n , i and the second proper value w n 
corresponding to the matching result of calculation F2(I j (n)) from the 
database memory by a reader. 

15 1 1 . A tag privacy protection method for preventing privacy 

information of a user from being acquiring from information which is 
delivered from a tag device, in which a first confidential value s ks s and a first 
proper value w k which correspond to each tag ID information id k are stored in 
a confidential value memory of each tag device k (ke { 1 , . . . , m} , where m 

20 represents a total number of tag devices) and in which a tag ID information 
id n (ne { 1, . . m}) and a second confidential value s nj i and a second proper 
value w n which correspond thereto are stored in a database memory of a 
backend apparatus in a manner relating to each other; comprising the steps of 
the tag device 

25 reading out the first confidential value s ks j and the first proper value 

w k from the confidential value memory and applying to a bit combination 
value thereof a second function F2 which disturbs a relationship between 
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elements of a definition domain and a mapping thereof to generate tag output 
information F2(s k> j | w k ) in a second calculator; 

delivering the tag output information F2(s k> i | w k ) from an output 

section; 

5 and reading out the first confidential value s^ \ from the confidential 

value memory, applying a first function F 1 , an inverse image of which is 
difficult to obtain, to the first confidential value s k) \ which is read out, and 
saving a result of such calculation Fl(Sk, j) as a new first confidential value s k> - t 
in the confidential value memory by overwriting in a first calculator; 
1 0 the backend apparatus 

accepting the tag output information F2(s kj i | w k ) as an input at an 
input section at an input section; 

reading out the second confidential value s n , i and the second proper 
value w n from the database memory, applying j times (j e {0, . . ., j ma x}) the 
15 first function Fl to the second confidential value s n , i to determine a bit 

combination value Fl j (s ns *) | w n of a resulting Fl j (s ns i) and the second proper 
value w n , and applying the second function F2 to the bit combination value 
F l J (s n , i) | w n in a third calculator; 

comparing the tag output information F2(s kj i | w k ) against a result of 
20 calculation in the third calculator F2(Fl J (s n , j) | w n ) in a comparator; 

in the event the tag output information F2(s k? \ | w k ) does not match 
the result of calculation F2(F 1 j (s n , j) | w n ), executing the processings in the 
third calculator and the comparator again by changing the value of at least one 
of n and j; 

25 and in the event the tag output information F2(s k? i | w k ) matches the 

result of calculation F2(Fl j (s nj i) | w n ), extracting the tag ID information id n 
which is related to the second confidential value s ns i and the second proper 
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value w n corresponding to the matching result of calculation F2(F l J (s n , i) | w n ) 
from the database memory by a reader. 

12. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
5 delivered from a tag device, in which a first proper value w k corresponding to 
each tag ID information id k and a first confidential value Si which assumes an 
identical initial value Si for a plurality of tag ID information are stored in a 
confidential value memory of each tag device k (ke { 1, . . ., m}, where m 
represents a total number of tag devices), each tag ID information id n (ne { 1, 

10 . . ., m}) and a corresponding second proper value w n are stored in a database 
memory of a backend apparatus in a manner relating to each other, and a first 
result of calculation Sj+i obtained by applying j times (j e {0, .. j max }) a first 
function Fl to the second confidential value Sj which is used in common by 
the plurality of tag ID information is stored in a calculated value memory of 

1 5 the backend apparatus; comrprising the steps of 
the tag device 

reading out the first confidential value Si and the first proper value w k 
from the confidential value memory and applying to a bit combination value 
thereof a second function F2 which disturbs a relationship between elements 
20 of a definition domain and a mapping thereof to generate tag output 
information F2(Si | w k ) in a second calculator; 

delivering the tag output information F2(Sj | w k ) from an output 

section; 

and reading out the first confidential value Sj from the confidential 
25 value memory, applying the first function Fl, an inverse image of which is 

difficult to obtain, to the first confidential value s x which is read out, and saves 
a result of such calculation Fl(Si) as a new first confidential value s i+ i in the 
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confidential value memory by overwriting in a first calculator; 
the backend apparatus 

accepting the tag output information F2(si | w k ) as an input at an 
input section; 

5 reading out a result of the first calculation Sj+i and the second proper 

value w n from the database memory to obtain a bit combination value s j+ i | w n 
thereof, and applying the second function F2 thereto in a third calculator; 

comparing the tag output information F2(Sj | w k ) against a result of 
the calculation by the third calculator F2(s j+ i | w n ) in a comparator; 
1 0 in the event the tag output information F2(si | w k ) does not match the 

result of the calculation F2(sj+i | w n ), executing the processings in the third 
calculator and the comparator again by changing the value of at least one of n 
andj; 

and in the event the tag output information F2(si | w k ) matches the 
15 result of the calculation F2(s j+ i | w n ) 5 extracting the tag ID information id n 

which is related to the second proper value w n corresponding to the matching 
result of calculation F2(s j+ i | w n ) from the database memory by a reader. 

13. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
20 delivered from a tag device, in which a combination of d (d>2) elements e u> vu 
(ue { 1, ...,d}) corresponding to each tag ID information id k is stored in a 
confidential value memory of each tag device k (ke { 1, . . m}, where m 
represents a total number of tag devices) and in which a combination of d 
initial elements f u , o comprising one selected from each of d kinds (d>2) of 
25 subgroups a u (ue{l, . . d}) and the tag ID information id n of each tag device 
n (ne { 1, . . m}) are stored in a database memory of a backend apparatus in a 
manner relating to each other comprising the steps of; 
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the tag device 

reading out the d elements e u , vu from the confidential value memory 
to form a bit combination value thereof which represents a confidential value 
s kj i and applying a second function F2 which disturbs a relationship between 
5 elements of a definition domain and a mapping thereof to the confidential 
value s k? i to generate tag output information a k> j=F2(s k , i) in a second 
calculator; 

delivering the tag output information a k> i from an output section; 
and extracting at least part of elements e^ vu . (u 1 e { 1 , . . . , d}) from the 
10 confidential value memory, applying a first function Fl, an inverse image of 
which is difficult to obtain, to the extracted elements e u } vu », and saving a result 
of such calculation Fl(e U ', vu .) as new elements e u », V u'+i in the confidential value 
memory by overwriting in a first calculator; 
the backend apparatus 
1 5 accepting the tag output information a ks 5 as an input at an input 

section; 

applying the first function Fl w u times (w u e {1,2, . . ., max}) to d 
initial elements f Uj 0 (ue { 1, . . ., d}) corresponding to the tag ID information 
id n , and applying the second function F2 to a bit combination value of these 
20 values Fl wu (f u , o) to determine a calculated value c in a third calculator; 

comparing the tag output information a ks j against the calculated value 
c in a comparator; 

in the event the tag output information a k? \ does not match the 
calculated value c, executing the processings in the third calculator and the 
25 comparator again by changing the value of at least part of n and w u ; 

and in the event the tag output information a k> \ matches the 
calculated value c, extracting tag ID information id n which is related to the 
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combination of d initial elements f u , o corresponding to the calculated value c 
from the database memory by a reader. 

14. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
5 delivered from a tag device, in which a combination of d (d>2) elements e u> vu 
(ue { 1, ...,d}) which corresponds to each tag ID information id k and a proper 
value y k which is inherent to each tag ID information id k are stored in a 
confidential value memory of each tag device k (ke { 1 , . . ., m}, where m 
represents a total number of tag devices) and in which a combination of d 
10 (d>2) elements e Uj vu (ue { 1, . . ., d}) which corresponds to each tag ID 
information id k and a proper value y k which is inherent to each tag ID 
information id k are stored in a database memory of a backend apparatus in a 
manner relating to each other; comprising the steps of 
the tag device 

1 5 reading out the d elements e u , vu and the proper value y k from the 

confidential value memory, and applying a second function F2 which disturbs 
a relationship between elements of a definition domain and a mapping thereof 
to a confidential value s^ j which is a bit combination value of the d elements 
and the proper value to generate tag output information a kj j=F2(s k , i) in a 
20 second calculator; 

delivering the tag output information a^ i from an output section; 
and extracting at least part of elements e u >, vu . (u'e { 1, . . d}) from the 
confidential value memory, applying a first function Fl, an inverse image of 
which is difficult to obtain, to the extracted elements e u «, vu s and saving a result 
25 of such calculation Fl (e u * 5 vu «) as new elements e Uj vu+ i in the confidential value 
memory by overwriting in a first calculator; 
the backend apparatus 
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accepting the tag output information a^ \ as an input at an input 

section; 

applying the first function Fl w u times (w u e {1,2, . . ., max}) to the d 
initial elements f u? 0 (ue { 1 , . . ., d}) corresponding to the tag ID information 
5 id n and applying the second function F2 to a bit combination value of the 
function values F l^fu, o) and the proper value y n to determine a calculated 
value c in a third calculator; 

comparing the tag output information a ks i against the calculated value 
c in a comparator; 

10 in the event the tag output information a k , i does not match the 

calculated value c, executing the processings in the third calculator and the 
comparator again by changing the value of al least part of n and w u ; 

and in the event the tag output information a^ i matches the 
calculated value c, extracting tag ID information id n which is related to the 

1 5 combination the plurality of initial elements f u> 0 corresponding to the 
calculated value c from the database memory by a reader. 

15. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which d (d>l) elements e UjVU (ue{l, . . ., d}) 

20 are stored in a confidential value memory of each tag device k (ke { 1, . . ., m}, 
where m represents a total number of tag devices), a manifold value z having t 
kinds (t>2) of values is stored in a first manifold value memory of each tag 
device k, a combination of d initial elements f Uj 0 comprising one selected 
from each of d kinds (d>l) of subgroups a u (ue { 1 , . . ., d}) and tag ID 

25 information id n (ne { 1, . . ., m}) of each tag device are stored in a database 
memory of a backend apparatus in a manner relating to each other, and the 
manifold value z is stored in a second manifold value memory of the backend 
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apparatus; comprising the steps of 
the tag device 

reading out each element e u? vu from the confidential value memory 
and reading out either manifold value z from the first manifold value memory 
5 and applying a second function F2 which disturbs a relationship between 

elements of a definition domain and a mapping thereof to a confidential value 
Sk, i which is a bit combination value of the elements and the manifold value to 
generate tag output information a k , j=F2(s kj j) in a second calculator; 

delivering the tag output information a ks j from an output section; 
10 and extracting at least part of elements e u », vu . (u' e { 1 , . . ., d}) from the 

confidential value memory each time the output section delivers the tag 
output information a k> j t times, applying a first function Fl, an inverse image 
of which is difficult to obtain, to the extracted elements e u < s vu <, and saving a 
result of such calculation Fl(e u - s vu ) as new elements e u », vu +i in the confidential 
1 5 value memory by overwriting in a first calculator; 
the backend apparatus 

accepting the tag output information a k> j as an input at an input 

section; 

applying the first function Fl w u times (w u e {1,2, . . ., max}) to the d 
20 initial elements f u? 0 (ue { 1 , . . d}) corresponding to the tag ID information 
id n and applying the second function F2 to a bit combination value of these 
values Fl wu (f U5 0 ) and the manifold value z to determine a calculated value c in 
a third calculator; 

comparing the tag output information a k> j against the calculated value 
25 c in a comparator; 

in the event the tag output information a kj \ does not match the 
calculated value c, executing the processings in the third calculator and the 
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comparator again by changing the value of at least part of n, w u and z; 

and in the event the tag output information a^ \ matches the 
calculated value c, extracting the tag ID information id n which is related to the 
combination of the d initial elements f U) 0 corresponding to the calculated 
5 value c from the database memory by a reader. 

16. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which d (d>2) elements e UjVU (ue{l, . . ., d}) 
are stored in a confidential value memory of each tag device k (ke { 1, . . ., m}, 
10 where m represents a total number of tag devices), a manifold value z u which 
assumes t u kinds (t u >2) of values for each u is stored in a first manifold value 
memory of each tag device k, a combination of d initial elements f u> 0 
comprising one selected from each of d kinds (d>2) of subgroups a u (ue{l, 
. . ., d}) and tag ID information id n (ne { 1, . . ., m}) of each tag device are 
1 5 stored in a database memory of a backend apparatus in a manner relating to 
each other, and the manifold value z u is stored in a second manifold value 
memory of the backend apparatus; comprising the steps of 

the tag device 

reading out each element e u , vu from the confidential value memory 
20 and reading out either manifold value z u for each u from the first manifold 
value memory and applying a second function F2 which disturbs a 
relationship between elements of a definition domain and a mapping thereof 
to a confidential value s k? j which is a bit combination value of e u? vu and z u to 
generate tag output information a k? r=F2(s k , i) in a second calculator; 
25^ delivering the tag output information a kj s from an output section; 

extracting at least part of elements e u » 9 VU ' (u 1 e { 1 , . . . , d } ) from the 
confidential value memory each time the output section delivers the tag 
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output information a k? \ some number of times, applying a first function Fl, an 
inverse image of which is difficult to obtain, to the extracted elements e u « 5 vu *> 
and saving a result of such calculation Fl(e u - s V u ) as new elements e U j vu +i in 
the confidential value memory by overwriting in a first calculator; 
5 the backend apparatus 

accepting the tag output information a k> j as an input at an input 

section; 

applying w u times (w u e { 1 , 2, . . . , max}) the first function F 1 to the d 
initial elements f Uj 0 (ue { 1 , . . d}) corresponding to the tag ID information 
10 id n , and applying the second function F2 to a bit combination value of these 
values Fl wu (f u , o) and the manifold value z u to determine a calculated value c 
in a third calculator; 

comparing the tag output information a^ j against the calculated value 
c in a comparator; 

15 in the event the tag output information a^ { does not match the 

calculated value c, executing the processings in the third calculator and the 
comparator again by changing the value of at least part of n, w u and z u ; 

and in the event the tag output information a kj j matches the 
calculated value c, extracting tag ID information id n which is related to the 
20 combination of a plurality of initial elements f u? 0 corresponding to the 
calculated value c from the database memory by a reader. 

17. A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a confidential value 
25 corresponding to tag ID information is stored; 

a second calculator connected to the confidential value memory for 
reading out the confidential value from the confidential value memory and for 
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applying a second function F2 which disturbs a relationship between elements 
of a definition domain and a mapping thereof to the confidential value which 
is read out to generate tag output information; 

an output section for delivering the tag output information; 
5 and a first calculator for reading out at least part of elements of the 

confidential value from the confidential value memory and for applying a first 
function Fl, a mapping of which is difficult to obtain, to the elements which 
are read out, with a result of such calculation being used to update the 
confidential value in the confidential value memory by overwriting. 
10 1 8. A backend apparatus for use in an automatic tag identification 

system comprising 

a database memory in which each tag ID information and a 
corresponding confidential value are related to each other; 

an input section which accepts tag output information as an input; 
15 a calculator for applying a first function Fl which is used in a tag 

device some number of times to at least part of elements of the confidential 
value in the database memory and which then applies a second function which 
is used in the tag device thererto; 

a comparator for sequentially comparing a result of the calculation in 
20 the calculator against the tag output information; 

and a reader for extracting the tag ID information which is related to 
the confidential value corresponding to the matching result of calculation 
when a matching between the result of calculation and the tag output 
information is found from the database memory. 
25 19. A tag device for use in an automatic tag identification system 

comprising 

a confidential value memory in which a first confidential value s k> j 
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corresponding to tag ID information id k is stored; 

a second calculator connected to the confidential value memory for 
reading out the first confidential value s^ j from the confidential value 
memory and for applying a second function F2 which disturbs a relationship 
5 between elements of a definition domain and a mapping thereof to the first 
confidential value s k) i to generate tag output information F2(s k , i); 

an output section for delivering the tag output information F2(s kj 0; 

and a first calculator connected to the confidential value memory for 
reading out the first confidential value s k , i from the confidential value 
1 0 memory, for applying a first function F 1 , an inverse image of which is 

difficult to obtain, to the first confidential value and for saving a result of such 
calculation Fl(s kj 0 as a new first confidential value s k) j+i in the confidential 
value memory by overwriting. 

20. A tag device according to Claim 19, further comprising 

15 a counter for counting a number of times rn the first confidential 

value is updated, 

the output section also delivering information which specifies the 
number of updating times m. 

21. A tag device for use in an automatic tag identification system 
20 comprising 

a confidential value memory in which a first confidential value s kj j 
and a first proper value w k which correspond to a tag ID information id k are 
stored; 

a second calculator connected to the confidential value memory for 
25 reading out the first confidential value s kj j from the confidential value 

memory and for applying a second function F2 which disturbs a relationship 
between elements of a definition domain and a mapping thereof to the first 
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confidential value to generate tag output information F2(s kj i); 

an output section for delivering the tag output information F2(s ks i); 

and a first calculator connected to the confidential value memory for 
reading out the first confidential value s k) { and the first proper value w k from 
5 the confidential value memory, for applying a first function Fl, an inverse 
image of which is difficult to obtain, to a bit combination value of the first 
confidential value and the first proper value and for saving a result of such 
calculation Fl(s k , \ | w k ) as a new first confidential value s kj i+1 in the 
confidential value memory by overwriting. 
10 22. A backend apparatus for use in an automatic tag identification 

system comprising 

a database memory in which each tag ID information id n (ne { 1 , . . 
m}, where m represents a total number of tag devices) and a second 
confidential value s n> i corresponding thereto are related to each other; 
15 an input section which accepts tag output information F2(s k? 0 as an 

input; 

a third calculator connected to the database memory for reading out 
the second confidential value s n , i from the database memory, applying j times 
(j g {0, . . ., jmax}) a first function Fl which is used in a tag device to each of 
20 the second confidential values s n> i which are read out, and for subsequently 
applying a second function F2 which is used in the tag device; 

a comparator for comparing the tag output information F2(s k) i) 
against a result of calculation in the third calculator F2(Fl j (s ns i)); 

a controller for causing the processings in the third calculator and the 
25 comparator to be executed again by changing the value of at least one of n 
and j in the event the tag output information F2(s k? j)- and the result of 
calculation F2(Fl j (s nj i)) do not match; 
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and a reader connected to the database memory and operative when 
the tag output information F2(s kj i)- matches the result of the calculation 
F2(Fl j (s n> i)) to extract the tag ID information id n which is related to the 
second confidential value s n , 1 corresponding to the matching result of the 
5 calculation F2(Fl j (s n> i)) from the database memory. 

23. A backend apparatus according to Claim 22 in which the input 
section accepts an input of information which specifies a number of times m 
the first confidential value is updated in the tag device, the third calculator 
applies the first function Fl j=rn times to each of the confidential values s n? i 

1 0 which are read out and then applies the second function F2 thereto, and the 
controller causes the processings in the third calculator and the comparator to 
be executed again by changing the value of n when the tag output information 
F2(s k> i)- does not match the result of the calculation F2(Fl j (s ns i)). 

24. A backend apparatus according to Claim 22 in which the 

15 database memory stores the result of the calculation F2(Fl J (s n? i)) in the third 
calculator in a manner relating it to the second confidential value s n , i, and the 
comparator performs a comparing processing by using the result of the 
calculation F2(Fl J (s nj j)) stored in the database memory. 

25. A backend apparatus for use in an automatic tag identification 
20 system comprising 

a database memory in which each tag ID information id n (ne { 1, . . ., 
m}), a corresponding second confidential value s n , i and second proper value 
w n are stored in a manner relating to each other; 

a input section which accepts an input of tag output information 

25 F2(s k , i); 

a third calculator connected to the database memory for reading out 
the second confidential value s n , i and the second proper value w n from the 
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database memory and for applying a second function F2 to I J (n) where I J (n)=s n? 
, 0=0), and I j (n)=Fl(I j I (n) | id n ) Q>\) to calculate F2(I j (n)); 

a comparator for comparing the tag output information F2(s k , 5 ) 
against the result of the calculation in the third calculator F2(I J (n)); 
5 a controller for causing the processings in the third calculator and the 

comparator to be executed again by changing the value of at least one of n 
and j when the tag output information F2(s k , i) does not match the result of the 
calculation F2(I j (n)); 

and a reader for extracting tag ID information id n which is related to 
1 0 the second confidential value s n , i and the second proper value w n 

corresponding to the matched result of calculation F2(I J (n)) from the database 
memory when a matching between the tag output information F2(s kj i) and the 
result of the calculation F2(I j (n)) is found. 

26. A tag device for use in an automatic tag identification system 
1 5 comprising 

a confidential value memory in which a first confidential value s kj i 
and a first proper value w k corresponding to tag ID information id k are stored; 

a second calculator connected to the confidential value memory for 
reading out the first confidential value s kj { and the first proper value w k from 
20 the confidential value memory and for applying a second function F2 which 
disturbs a relationship between elements of a definition domain and a 
mapping thereof to a bit combination value of the first confidential value and 
the first proper value to generate tag output information F2(s k? { | w k ); 

an output section for delivering the tag output information F2(s k? \ \ 

25 w k ) 

and a first calculator connected to the confidential value memory for 
reading the first confidential value s kj \ from the confidential value memory, 
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applying a first function Fl, an inverse image of which is difficult to obtain, 
to the first confidential value s k> j which is read out and saving a result of such 
calculation Fl(s k , 0 as a new first confidential value s kj j+i in the confidential 
value memory by overwriting. 
5 27. A backend apparatus for use in an automatic tag identification 

system comprising 

a database memory in which each tag ID information id n (ne { 1, . . 
m}) and a corresponding second confidential value s n , i and second proper 
value w n are stored in a manner relating to each other; 
10 an input section which accepts an input of tag output information 

F2(s k , i | w k ); 

a third calculator connected to the database memory for reading out 
the second confidential value s n , i and the second proper value w n from the 
database memory, applying j times (j e {0, . . j max }) a first function Fl which 

15 is used in a tag device to the second confidential value s n> i, determining a bit 
combination value Fl j (s n> j) | w n of a result of application Fl J (s n? i) and the 
second proper value w n , and applying a second function F2 which is used in 
the tag device to the bit combination value Fl J (s n , i | w n ); 

a comparator for comparing the tag output information F2(s k , j | w k ) 

20 against a result of calculation in the third calculator F2(F l J (s nj j) | w n ); 

a controller for causing the processings in the third calculator and the 
comparator to be executed again by changing the value of at least one of n 
and j when the tag output information F2(s kj \ | w k ) does not match the result of 
the calculation F2(Fl J (s nj i) | w n ); 

25 and a reader connected to the database memory for extracting the tag 

ID information id n which is related to the second confidential value s n> i and 
the second proper value w n corresponding to the matched result of calculation 
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F2(Fl j (s ns i) | w n ) when a matching between the tag output information F2(s k> i | 
w k ) and the result of the calculation F2(Fl j (s n , j) | w n ) is found. 

28. A tag device for use in an automatic tag identification system 
comprising 

5 a confidential value memory in which a first proper value w k 

corresponding to each tag ID information id k and a first confidential value Sj 
which assumes an equal initial value Si for a plurality of tag ID information 
are stored; 

a second calculator connected to the confidential value memory for 
1 0 reading out the first confidential value Sj and the first proper value w k from the 
confidential value memory and for applying a second function F2 which 
disturbs a relationship between elements of a definition domain and a 
mapping thereof to a bit combination value of the first confidential value and 
the first proper value to generate tag output information F2(Sj | w k ); 
1 5 an output section for delivering the tag output information F2(Sj | w k ); 

and a first calculator connected to the confidential value memory for 
reading out the first confidential value Sj from the confidential value memory, 
applying a first function Fl, an inverse image of which is difficult obtain, to 
the first confidential value S\ which is read out and saving a result of such 
20 calculation Fl(Si) as a new first confidential value Sj+i in the confidential value 
memory by overwriting. 

29. A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which each tag ID information id n (ne { 1, . . ., 
25 m}) and a corresponding second proper value w n are stored in a manner 
relating to each other; 

a calculated value memory in which first results of calculation Sj+i are 
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stored which are obtained by applying j times (j e {0, . . j max }) a first function 
which is used in a tag device to a second confidential value Si which is used in 
common for a plurality of tag ID information; 

an input section which accepts an input of tag output information 
5 F2( Si | w k ); 

a third calculator connected to the database memory for reading out 
the first result of calculation s i+{ and the second proper value w n from the 
database memory to obtain a bit combination value thereof Sj+i | w n and for 
applying a second function F2 which is used in the tag device thereto; 
10 a comparator for comparing the tag output information F2(Sj | w k ) 

and the result of calculation in the third calculator F2(Sj+i | w n ); 

a controller for causing the processings in the third calculator and the 
comparator to be executed again by changing the value of at least one of n 
and j when the tag output information F2(Si | w k ) does not match the result of 
15 calculation F2(sj +1 | w n ); 

and a reader connected to the database memory for extracting the 
tag ID information id n which is related to the second proper value w n 
corresponding to the matched result of calculation F2(sj+i | w n ) when a 
matching between the tag output information F2(Sj | w k ) and the result of 
20 calculation F2(s j+ i | w n ) is found. 

30. A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a combination of d (d>2) 
elements e u?vu (ue{l, . . d}) which corresponds to each tag ID information 
25 id k is stored; 

a second calculator connected to the confidential value memory for 
reading out the d elements e u , vu from the confidential value memory and for 
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applying a second function F2 which disturbs a relationship between elements 
of a definition domain and a mapping thereof to a confidential value s k? j 
which is a bit combination value of the d elements to generate tag output 
information a k , j=F2(s kj i); 
5 an output section for delivering the tag output information a k? j; 

and a first calculator connected to the confidential value memory for 
extracting at least part of elements e u - 5 vu . (u'g { 1, . . ., d}) from the confidential 
value memory, for applying a first function Fl, an inverse image of which is 
difficult to obtain, to the extracted elements e^ VU ' and for saving a result of 
10 such calculation Fl(e u - 5 vu ») as new elements e u < s V u*+i in the confidential value 
memory by overwriting. 

31. A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f u , 0 
15 comprising one selected from each of d kinds (d>2) of subgroups a u (ue{l, 
. . d}), and tag ID information id n of each tag device n (ne { 1, . . m}, where 
m represents a total number of tag devices) are stored in a manner relating to 
each other; 

an input section for accepting an input of tag output information a k , j; 
20 a third calculator for applying w u times (w u e {1,2, . . max}) a first 

function Fl to the d initial elements f U) o (ue { 1 , . . ., d}) which correspond to 
the tag ID information id n and for applying a second function F2 to a bit 
combination value of these values Fl wu (f U)0 ) to determine a calculated value c; 
a comparator for comparing the tag output information a k? { against 
25 the calculated value c; 

a controller for causing the processings in the third calculator and the 
comparator to be executed again by changing the value of at least part of n 
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and w u when the tag output information a k> \ does not match the calculated 
value c; 

and a reader connected to the database memory for extracting tag ID 
information id n which is related to the combination of d initial elements f Uj 0 
5 corresponding to the calculated value c when the tag output information a kj j 
matches the calculated value c. 

32. A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a combination of d (d>2) 
1 0 elements e UjVU (ue{l, . . d}) which correspond to each tag ID information id k 
and a proper value y k which is inherent to each tag ID information id k are 
stored; 

a second calculator connected to the confidential value memory for 
reading out the d elements e Uj vu and the proper value y k from the confidential 

1 5 value memory and for applying a second function F2 which disturbs a 

relationship between elements of a definition domain and a mapping thereof 
to a confidential value s k> { which is a bit combination value of the d elements 
and the proper value to generate tag output information a k , r z F2(s ky i); 

an output section for delivering the tag output information a k , \\ 

20 and a first calculator connected to the confidential value memory for 

extracting at least part of the elements e u ? vu » (u ? e { 1 , . . ., d}) from the 
confidential value memory, applying a first function F 1 , an inverse image of 
which is difficult to obtain, to the extracted elements e u * s vu - and for saving a 
result of such calculation Fl(e u ^ vu ) as new elements e u - ? VU '+i in the confidential 

25 value memory by overwriting; 

33. A backend apparatus for use in an automatic tag identification 
system comprising 
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a database memory in which a combination of d initial elements f U) 0 
comprising one selected from each of d kinds (d>2) of subgroups a u (ue{l, 
. . d}), a proper value y n which is inherent to each tag ID information id n 
(ne { 1, . . m}) and each tag ID information id n are stored in a manner 
5 relating to each other; 

an input section for accepting an input of tag output information a kj i; 

a third calculator for applying w u times (w u e {1,2, . . max}) a first 
function Fl to the d initial elements f U)0 (ue {1, d}) corresponding to the 
tag ID information id n and for applying a second function F2 to a bit 
1 0 combination value of these values F 1 ^(fu, o) and the proper value y n to 
determine a calculated value c; 

a comparator for comparing the tag output information a k> { against 
the calculated value c; 

a controller for causing the processings in the third calculator and the 
1 5 comparator to be executed again by changing the value of at least part of n 
and w u when the tag output information a kj \ does not match the calculated 
value c; 

and a reader connected to the database memory for extracting tag ID 
information id n which is related to the combination of a plurality of initial 
20 elements f Uj 0 corresponding to the calculated value c from the database 
memory when a matching between the tag output information a kj j and the 
calculated value c is found. 

34. A tag device for use in an automatic tag identification system 
comprising 

25 a confidential value memory in which d (d>l) elements e Uj vu (ue { 1, 

d}) are stored; 

a first manifold value memory in which a manifold value z which 
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assumes t kinds (t>2) of values is stored; 

a second calculator connected to the confidential value memory and 
the first manifold value memory for reading out the elements e Uj vu from the 
confidential value memory and for reading out either manifold value z from 
5 the first manifold value memory and for applying a second function F2 which 
disturbs a relationship between elements of a definition domain and a 
mapping thereof to a confidential value s k5 j which is a bit combination value 
of the elements and the manifold value to generate tag output information a k> 
i=F2(s k , i); 

1 0 an output section for delivering the tag output information a k , \\ 

and a first calculator connected to the confidential value memory for 
extracting at least part of elements e u . s vu . (u f e { 1, . . ., d}) from the confidential 
value memory each time the output section delivers the tag output information 
a k , i t times, for applying a first function Fl, an inverse image of which is 

15 difficult to obtain, to the extracted elements e u > 5 vu . and for saving a result of 
such calculation Fl(e u » 5 V u0 as new elements e U ' ? VU '+i in the confidential value 
memory by overwriting . 

35. A tag device according to Claim 34 in which as long as the first 
calculator does not update elements in the confidential value memory, the 

20 manifold value z used by the second calculator in generating the tag output 

information a ks \ changes each time the tag output information a kj j is generated. 

36. A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f u? 0 
25 comprising one selected from each of d kinds (d>l) of subgroup a u (ue { 1, . . ., 
d}) and a tag ID information id n (n€ { 1 , . . ., m}) of each tag device are stored 
in a manner relating to each other; 
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a second manifold value memory in which a manifold value z which 
assumes t kinds (t>2) of values is stored; 

an input section for accepting an input of tag output information a k5 \ 9 
a third calculator for applying w u times (w u e {1,2, . . max}) a first 
5 function F 1 to the d initial elements f u> 0 (ue { 1 , . . d}) in the database 

memory which correspond to the tag ID information id n and for applying a 
second function F2 to a bit combination value of these values Fl ^(fu, o) and 
the manifold value z in the second manifold value memory to determine a 
calculated value c; 

10 a comparator for comparing the tag output information a kj \ against 

the calculated value c; 

a controller for causing the processings in the third calculator and the 
comparator to be executed again by changing the value at least part of n, w u 
and z when the tag output information a k? ; does not match the calculated value 

15 c; 

and a reader connected to the database memory for extracting the tag 
ID information id n which is related to the combination of d initial elements f Uj 
o corresponding to the calculated value c from the database memory when a 
matching between the tag output information a ks \ and the calculated value c is 
20 found. 

37. A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which d (d>2) elements e Uj vu (ue { 1, 
d}) are stored; 

25 a first manifold value memory in which a manifold value z u which 

assumes t u kinds (t u >2) of values for each u is stored; 

a second calculator connected to the confidential value memory and 
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the first manifold value memory for reading out the elements e Ui vu from the 
confidential value memory and for reading out either manifold value z u for 
each u from the first manifold value memory and for applying a second 
function F2 which disturbs a relationship between elements of a definition 
5 domain and a mapping thereof to a confidential value s K j which is a bit 

combination value of these e Vs vu and z u to generate tag output information a ki 
r=F2( SkJ ); 

an output section for delivering the tag output information a k) x \ 
and a first calculator connected to the confidential value memory for 
10 extracting at least part of the elements e u . 5 vu > (u f e { 1 , . . ., d}) from the 
confidential value memory each time the output section delivers the tag 
output information a k , i some number of times, for applying a first function Fl, 
an inverse image of which is difficult to obtain, to the extracted elements e u « 5 vus 
and for saving a result of such calculation F 1 (e u « 3 V u0 as new elements e u » ? VU '+i in 
1 5 the confidential value memory by overwriting. 

38. A tag device according to Claim 37 in which each time the 
output section delivers the tag output information a ks j, the first calculator 
extracts at least part of the elements e u > VU ' from the confidential value memory, 
applies the first function Fl to the extracted elements e u > y VU ' and saves a result 

20 of such calculation Fl^, vu «) as new elements e u - s VU '+i in the confidential value 
memory by overwriting. 

39. A tag device according to Claim 37 in which each time the 

d 

output section delivers the tag output information a kj i ^t u times, the first 

u=l 

calculator extracts at least part of the elements e u - 5 VU ' from the confidential 
25 value memory, applies the first function Fl to the extracted elements e u » 5 vu s 
and saves a result of such calculation Fl(e u < s VU ') as new elements e u - 5 vu » +1 in the 
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confidential value memory by overwriting. 

40. A tag device according Claim 39 in which as long as the first 
calculator does not update the elements in the confidential value memory, a 
combination of manifold values z u (ug { 1 , . . d}) which are used by the 

5 second calculator in generating the tag output information a^ \ changes each 
time the tag output information a k> \ is generated. 

41 . A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f Us 0 
10 which comprises one selected from each of d kinds (d>l) of subgroups <x u 
(ue { 1, . . d}) and tag ID information id n (ne {1, . . m}) of each tag device 
are stored in a manner relating to each other; 

a second manifold value memory in which a manifold value z u which 
assumes t u kinds (t u >2) of values for each u is stored; 
15 an input section for accepting an input of tag output information a k? j; 

a third calculator for applying w u times (w u e {1,2, . . max}) a first 
function Fl which is used in a tag device to the d initial elements f Uj o(ue{l, 
. . ., d}) corresponding to the tag ID information id n and for applying a second 
function F2 which is used in the tag device to a bit combination value of these 
20 values Fl wu (f u , 0 ) and the manifold value z u to determine a calculated value c; 

a comparator for comparing the tag output information a k? \ against 
the calculated value c; 

a controller for causing the processings in the third calculator and the 
comparator to be executed again by changing the value of at least part of n, w u 
25 and z; 

and a reader connected to the database memory for extracting tag ID 
information id n which is related to the combination of the d initial elements f u , 
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o corresponding to the calculated value c from the database memory when a 
matching between the tag output information a k> i and the calculated value c is 
found. 

42. A tag privacy protection method for preventing privacy 
5 information of a user from being acquired from information which is 

delivered from a tag device, in which privileged ID information sid h which is 
formed by privileging respective tag ID information id h is stored in a 
confidential value memory of each tag device; comprising the steps of 
the tag device 

1 0 reading out the privileged ID information sid h stored in the 

confidential value memory in a read/write section; 

and delivering the privileged ID information sid h to an updater which 
is provided externally of each tag device from a first output section; 

the updater 

15 accepting an input of the privileged ID information sid h at a first 

input section; 

generating new privileged ID information sid h ? , the association of 
which with the privileged ID information sid h is difficult to follow in an 
updating section; 

20 delivering the new privileged ID information sid h f to the tag device 

from a second output section; 

the tag device further 

accepting an input of the new privileged ID information sid h f at a 
second input section; 
25 the read/write section of the tag device storing the new privileged ID 

information sid h f in the confidential value memory. 

43. A tag privacy protection method for preventing privacy 
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information of a user from being acquired from information which is 
delivered from a tag device, in which the privileged ID information sid h 
which is a random value r h related to each tag ID information id h is stored in a 
confidential value memory of each tag device h(he{l, ...,m}, where m 
5 represents a total number of tag devices), and each tag ID information id h and 
privileged ID information sid h which is the random value r h related to the tag 
ID information id h are stored in a privileged ID memory of an updater which 
is provided externally of each tag device h in a manner relating to each other; 
comprising the steps of 
1 0 the tag device h 

reading out the privileged ID information sid h stored in the 
confidential value memory thereof in a first read/write section; 

and delivering the privileged ID information sid h to the updater from 
a first output section; 
1 5 the updater 

accepting an input of the privileged ID information sid h at a first 
input section; 

generating a new random value r h f in a random value generator; 
selecting tag ID information id h corresponding to the privileged ID 
20 information sid h which is accepted as the input from the privileged ID 

memory and storing the new random value r h f in the privileged ID memory in 
a manner relating to new privileged ID information sid h * in a second 
read/write section; 

and delivering the new privileged ID information sid h ! to the tag 
25 device h from a second output section; 
the tag device h further 

accepting an input of the new privileged ID information sidh at a 
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second input section; 

the read/write section of the tag device storing the new privileged ID 
information sid h ' in the confidential value memory. 

44. A tag privacy protection method for preventing privacy 
5 information of a user from being acquired from information which is 

delivered from a tag device, in which privileged ID information sid h is stored 
in a confidential value memory of each tag device h (he { 1, . . m}, where m 
represents a total number of tag devices), the privileged ID information sid h 
including a first encrypted text according to a common key encryption 
1 0 technique which corresponds to each tag ID information id h and key ID 
information kidj of a common key kj used in the encryption (j e { 1, . . n}, 
where n represents a total number of tag devices), and each key ID 
information kidj are stored and each common key kj in a key memory of an 
updater which is provided externally of each tag device h in a manner relating 
1 5 to each other; comprising the steps of 
the tag device h 

reading out the privileged ID information sid h stored in the 
confidential value memory thereof in a first read/write section; 

and delivering the privileged ID information sid h to an updater from 
20 a first output section; 

the updater 

accepts an input of the privileged ID information sid h at a first input 

section; 

extracting the common key k, corresponding to the key ID 
25 information kidj included in the privileged ID information sid h from the key 
memory by a second read/write section; 

decrypting the first encrypted text using the common key kj extracted 
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by the second read/write section to extract tag ID information id h by an ID 
extractor; 

generating a second encrypted text, the association of which with the 
first encrypted text is difficult to follow, using the tag ID information idh 
5 extracted by the ID extractor and the common key kj which is used in the 
extraction in an encryptor; 

and delivering new privileged ID information sid h f including the 
second encrypted text and the key ID information kidj of the common key kj 
to the tag device h from a second output section; 
1 0 the tag device h further 

accepting an input of the new privileged ID information sid h ' at a 
second input section; 

the first read/write section of the tag device storing the new 
privileged ID information sid h ! in the confidential value memory. 
15 45. A tag privacy protection method for preventing privacy 

information of a user from being acquired from information which is 
delivered from a tag device, in which privileged ID information sid h is stored 
in a confidential value memory of each tag device h (he { 1, ...,m}, where m 
represents a total number of tag devices), the privileged ID information sid h 
20 including a first encrypted text according to a pubic key encryption technique 
which corresponds to each tag ID information id h and key ID information kidj 
for a key pair (skj, pkj) (where skj represents a secret key and pkj represents a 
public key, j e { 1 , . . ., n}, where n represents a total number of tag devices), 
and each key ID information kidj and each key pair (skj, pkj) in a key memory 
25 of an updater which is provided externally of each tag device h in a manner 
relating to each other; comprising the steps of 

the tag device h 
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reading out the privileged ID information sid h stored in the 
confidential value memory in a first read/write section; 

and delivering the privileged ID information sid h to an updater from 
a first output section; 
5 the updater 

accepting an input of the privileged ID information sid h at a first 
input section; 

extracting the key pair (skj, pkj) which corresponds to the key ID 
information kidj which is included in the privileged ID information sid h 
10 accepted as the input to the first input section by a second read/write section; 

decrypting the first encrypted text using the secret key skj extracted 
by the second read/write section to extract the tag ID information id h by an ID 
extractor; 

generating a second encrypted text, the association of which with the 
15 first encrypted text is difficult to follow, using the tag ID information id h 
extracted by the ID extractor and the public pkj which is extracted by the 
second read/write section by an encryptor; 

and delivering new privileged ID information sid h ' including the 
second encrypted text and the key ID information kidj of the key pair (skj, pkj) 
20 to the tag device h from a second output section; 
the tag device h further 

accepting an input of the new privileged ID information sid h f at a 
second input section; 

the read/write section storing the new privileged ID information sid h ' 
25 in the confidential value memory. 

46. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
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delivered from a tag device, in which privileged ID information sid h is stored 
in a confidential value memory of each tag device h (he { 1 , . . ., m}, where m 
represents a total number of tag devices), the privileged ID information sid h 
including a first encrypted text according to re-encryptable public key 
5 encryption technique which corresponds to each tag ID information id h and 
key ID information kidj of the public key pkj (j e { 1, . . ., n}, where n 
represents a total number of keys), each key ID information kidj and each 
public key pkj are stored in a key memory of an updater which is provided 
externally of each tag device h in a manner relating to each other; comprising 
1 0 the steps of 

the tag device h 

reads out the privileged ID information sid h stored in the confidential 
value memory in a first read/write section; 

and delivers the privileged ID information sid h to an updater from a 
1 5 first output section; 

the updater comprising 

accepting an input of the privileged ID information sid h at a first 
input section; 

extracting the public key pkj which corresponds to the key ID 
20 information kidj included in the privileged ID information sid h which is 
accepted as the input to the first input section from the key memory by a 
second read/write section; 

re-encrypting the first encrypted text in the privileged ID information 
sid h using the public key pkj extracted by the second read/write section to 
25 generate a second encrypted text, the association of which with the first 
encrypted text is difficult to follow, by an encryptor; 

and for delivering new privileged ID information sid h f including the 
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second encrypted text and the key ID information kidj of the public key pkj to 
the tag device h from a second output section; 
the tag device h further 

accept an input of the new privileged ID information sid h f at a second 
input section; 

the read/write section storing the new privileged ID information sid h f 
in the confidential value memory. 

47. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which privileged ID information sid h which 
has privileged each tag ID information id h is stored in a confidential value 
memory of each tag device h (he { 1, ...,m}, where m represents a total 
number of tag devices); comprising the steps of 

the tag device h 

reading out the privileged ID information sid h stored in the 
confidential value memory by a first read/write section; 

and delivering the privileged ID information sid h to a first updater 
which is provided externally of the tag device h from a first output section; 

the first updater 

accepting an input of the privileged ID information sid h at a first 
input section; 

determining tag ID information id h from the privileged ID 
information sid h by an ID extractor; 

and delivering the tag ID information id h to a second updater which 
is provided externally of the tag device h from a second output section; 

the second updater 

accepting an input of the tag ID information id h at a third input 
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section; 

generating new privileged ID information sid h * which has privileged 
the tag ID information id h by an encryptor; 

and delivering the new privileged ID information sid h * to the tag 
5 device h from a third output section; 

the tag device h further accepting an input of the new privileged ID 
information sid h f at a second input section; 

the read/write section storing the new privileged ID information sid h ' 
in the confidential value memory. 
10 48. An updater for updating privileged ID information in a tag 

device, the updater being provided externally of the tag device and 
comprising 

a privileged ID memory for storing each tag ID information id h and 
privileged ID information sid h which is a random value r h which corresponds 
15 to the tag ID information id h in a manner relating to each other; 

a first input section which accepts an input of the privileged ID 
information sid h which is delivered from the tag device; 

a random value generator for generating a new random value r h f ; 

a second read/write section connected to the privileged ID memory 
20 for selecting tag ID information id h which corresponds to the privileged ID 
information sid h which is accepted by the first input section as the input from 
the privileged ID memory and for relating this with the new random value r h f 
as new privileged ID information sid h ' to be stored in the privileged ID 
memory; 

25 and a second output section for delivering the new privileged ID 

information sid h f to the tag device h. 

49. An updater for updating privileged ID information in a tag 
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device, the updater being provided externally of the tag device and 
comprising 

a key memory for storing each key ID information kidj (j e { 1, . . ., n}, 
where n represents a total number of keys) and each common key k, of a 
5 common key encryption technique in a manner relating to each other; 

a first input section for accepting an input of privileged ID 
information sid h which includes a first encrypted text according to the 
common key encryption technique which corresponds to the tag ID 
information id h and key ID information kidj of the common key kj which is 
1 0 used in the encryption; 

a second read/write section connected to the key memory for 
extracting the common key kj which corresponds to the key ID information 
kidj which is included in the privileged ID information sid h from the key 
memory; 

15 an ID extractor for decrypting the first encrypted text using the 

common key kj which is extracted by the second read/write section to extract 

tag ID information id h ; 

an encryptor for generating a second encrypted text, the association 

of which with first encrypted text is difficult to follow, using the tag ID 
20 information id h extracted by the ID extractor and the common key kj which is 

used in the extraction; 

and a second output section for delivering new privileged ID 

information sidh* which includes the second encrypted text and the key ID 

information kidj for the common key k, to the tag device h. 
25 50. An updater for updating privileged ID information in a tag 

device, the updater being provided externally of the tag device and 

comprising 
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a key memory for storing each key ID information kidj 0 e O> • • •> n K 
where n represents a total number of keys) and each key pair (sk j? pkj) (skj 
represents a secret key and pkj a public key) in a manner relating to each 
other; 

5 a first input section for accepting an input of privileged ID 

information sid h which includes a first encrypted text according to a public 
key encryption technique which corresponds to tag ID information id h and 
key ID information kidj for the public key pkj which is used in the encryption; 
a second read/write section connected to the key memory for 
10 extracting the key pair (skj, pkj) which corresponds to the key ID information 
kidj which is included in the privileged ID information sid h accepted by the 
first input section as the input from the key memory; 

an ID extractor for decrypting the first encrypted text using the secret 
key skj extracted by the second read/write section to extract tag ID 
1 5 information id h ; 

an encryptor for generating a second encrypted text, the association 
of which with the first encrypted text is difficult to follow, using the tag ID 
information id h extracted by the ID extractor and the public key pkj extracted 
by the second read/write section; 
20 and a second output section for delivering new privileged ID 

information sidh 1 which includes the second encrypted text and the key ID 
information kidj for the key pair (skj, pkj) to the tag device h. 

5 1 . An updater for updating privileged ID information in a tag 
device, the updater being provided externally of the tag device and 
25 comprising 

a key memory for storing each key ID information kidj 0 G O> • • •> n )> 
where n represents a total number of keys) and each public key pkj in a 
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manner relating to each other; 

a first input section for accepting an input of privileged ID 
information sid h which includes a first encrypted text according to 
re-encryptable public key encryption technique which corresponds to tag ID 
5 information id h and key ID information kidj for the public key pkj; 

a second read/write section connected to the key memory for 
extracting the public key pkj which corresponds to the key ID information kidj 
which is included in the privileged ID information sid h which is accepted by 
the first input section as the input from the key memory; 
10 an encryptor for re-encrypting the first encrypted text which is 

included in the privileged ID information sid h using the public key pkj 
extracted by second read/write section to generate a second encrypted text, the 
association of which with the first encrypted text is difficult to follow; 

and a second output section for delivering new privileged ID 
1 5 information sid h f which includes the second encrypted text and the key ID 
information kidj for the public key pkj to the tag device h. 

52. An updater according to one of Claims 49 to 5 1 in which the 
key ID information kidj is information which is shared by a plurality unrelated 
tag devices. 

20 53. An update solicitor for soliciting an updater to update 

privileged ID information in a tag device, the update solicitor being provided 
externally of the tag device and comprising 

a privileged ID input section to which a plurality of kinds of 
privileged ID's, which are re-encryptable encrypted texts corresponding to an 
25 identical tag ID information id h , are input; 

a privileged ID memory for storing a plurality of kinds of privileged 
ID's which are input thereto; 
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a privileged ID extractor connected to the privileged ID memory for 
extracting one of privileged ID's from the privileged ID memory at a given 
opportunity; 

and a privileged ID output section for delivering the extracted 
5 privileged ID to the tag device. 

54. A tag device for use in an automatic tag identification system 
comprising 

a privileged ID input section to which a plurality of kinds of 
privileged ID's, which are re-encryptable encrypted texts corresponding to an 
1 0 identical tag ID information id h , are input; 

a privileged ID memory for storing the plurality of kinds of 
privileged ID's which are input thereto; 

a privileged ID extractor connected to the privileged ID memory for 
extracting one of the privileged ID's from the privileged ID memory at a 
1 5 given opportunity; 

a privileged ID extractor connected to the privileged ID memory for 
extracting one of the privileged ID's from the privileged ID memory at a 
given opportunity; 

and a privileged ID output section for delivering the extracted 
20 privileged ID. 

55. A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is 
delivered from a tag device, in which a key ID and a key are stored in a key 
memory in a manner relating to each other, the tag device comprises a 

25 privileged ID memory including a read-only region in which a key ID is 
stored and a rewritable region in which a first privileged ID is stored; 
comprising the steps of 
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the tag device 

extracting the key ID and the first privileged ID from the privileged 
ID memory by a read/write section; 

and delivering the extracted key ID and first privileged ID to an 
5 updater from a first output section; 
the updater 

accepting the key ID and the first privileged ID as inputs at a first 
input section; 

extracting a key which corresponds to the key ID which is input to 
1 0 the first input section from the key memory by a first key extractor; 

generating a second privileged ID, the association of which with the 
first privileged ID is difficult to follow, using the key extracted by the first 
key extractor and the first privileged ID which is input to the first input 
section in a privileged ID updating section; 
1 5 and delivering the second privileged ID from a second output 

section; 

the tag device further 

accepting an input of the second privileged ID at a second input 

section; 

20 the read/write section storing the second privileged ID in the 

rewritable region of the privileged ID memory. 

56. A tag privacy protection method according to Claim 55, further 
comprising the steps of 

the updater additionally including a verification information 
25 generator which generates a verification information for the second privileged 
ID; 

the second output section of the updater delivering the second 
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privileged ID and the verification information; 

the second input section of the tag device accepting the second 
privileged ID and the verification information as inputs; 

the read/write section of the tag device storing the second privileged 
5 ID and the verification information in the rewritable region the of privileged 
ID memory. 

57. A tag privacy protection method according to Claim 55, further 
comprising the steps of 

the read/write section of the tag device extracting the key ID from the 
1 0 read-only region of the privileged ID memory and extracting a third 

privileged ID from the rewritable region, the first output section of the tag 
device delivering the extracted key ID and the third privileged ID to a 
decryptor; 

the decryptor 

1 5 accepting the key ID and the first privileged ID as inputs at a third 

input section; 

extracting a key which corresponds to the key ID which is accepted 
by the third input section as an input from the key memory by a second key 
extractor; 

20 calculating an ID using the privileged ID which is input to the third 

input section and the key extracted by the second key extractor in an ID 
calculator; 

and verifying the structure of the calculated ID by an ID structure 

verifier. 

25 58. A tag device for use in an automatic tag identification system 

comprising 

a privileged ID memory including a read-only region in which a key 
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ID is stored and a rewritable region in which a first privileged ID is stored; 

a read/write section for extracting the key ID and the first privileged 
ID from the privileged ID memory; 

a first output section for delivering the key ID and the first privileged 
5 ID which are extracted; 

and a second input section for accepting an input of a second 
privileged ID, the association of which with the first privileged ID is difficult 
to follow; 

the read/write section storing the second privileged ID which is input 
10 in the rewritable region of the privileged ID memory. 

59. A tag device according to Claim 58 in which the second input 
section additionally accepts an input of verification information for the second 
privileged ID and the read/write section additionally stores the verification 
information which is input in the rewritable region of the privileged ID 

1 5 memory. 

60. A tag device according to Claim 58 in which the privileged ID 
represent information which is part of information constituting an ID and 
which is inherent to each tag device, which is privileged alone. 

61. A tag device according to Claim 58 in which an identical key 
20 ID is allocated to unrelated tag devices. 

62. A tag program for enabling a computer to function as a tag 
device according to one of Claims 17, 54 and 58. 

63. A tag program for enabling a computer to function as a backend 
apparatus according to Claim 18. 

25 64. An updating program for enabling a computer to function as an 

updater according to one of Claims 48 to 5 1 . 

65. An update soliciting program for enabling a computer to 
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function as an update solicitor according to Claim 53. 

66. A computer readable record medium storing a tag program 
which enables a computer to function as a tag device according to one of 
Claims 17, 54 and 58. 

67. A computer readable record medium storing a tag program 
which enables a computer to function as a backend apparatus according to 
Claim 18. 

68. A computer readable record medium storing an update program 
which enables a computer to function as an updater according to one of 
Claims 48 to 51. 

69. A computer readable record medium storing an update 
soliciting program which enables a computer to function as an update solicitor 
according to Claim 53. 



